api[.]islamhorizon[.]com

This domain, api.islamhorizon.com, is flagged for elevated-risk credential theft activity targeting users of a ride-hailing service. Analysis indicates the site impersonates Valo.taxi, a legitimate transportation platform, to harvest login credentials, payment details, or personal information under the guise of cash payments and ride bookings. The inclusion of Hindi text in the page title ('नकद और सवारी') suggests a targeted campaign aimed at users in specific geographic regions, likely leveraging localized social engineering tactics to increase success rates. Infrastructure analysis reveals the domain was registered on June 15, 2022, through Domain.com via Network Solutions, LLC, and resolves to the IP address 185.149.120.183. Detection metrics show 13 out of 95 security vendors on VirusTotal have flagged the domain as malicious, while it appears on at least one additional security blocklist. The Gridinsoft trust score for this domain is 0 out of 100, indicating a complete lack of legitimacy. Technical indicators include the use of Cloudflare and DDoS-Guard for traffic obfuscation, Let’s Encrypt for SSL certification, and frontend frameworks such as Ant Design and Vue.js, which are commonly employed to mimic the look and feel of authentic platforms. The presence of jsDelivr and cdnjs further suggests an attempt to blend in with legitimate web traffic. Mitigation measures for this credential theft campaign should focus on immediate containment and user awareness. Network administrators are advised to block the domain and its resolving IP (185.149.120.183) at the firewall or DNS level to prevent access. End-users who may have interacted with the site should be instructed to reset credentials for any accounts accessed during the suspected compromise, particularly those associated with financial services or ride-hailing platforms. Organizations should monitor for anomalous login attempts or unauthorized transactions originating from accounts linked to the targeted service. Given the localized nature of the phishing content, regional cybersecurity teams should disseminate alerts to raise awareness among potential victims, emphasizing verification of domain authenticity before entering sensitive information.